Alan Butler Archives

Recently in Alan Butler Category

February 24, 2015

EPIC recently filed comments on proposed amendments to Rule 41 of the Federal Rules of Criminal Procedure, which would authorize judges to issue "remote access" search warrants in certain cases. As EPIC outlined, the surreptitious computer searches conducted under these remote access warrants would run afoul of an important Fourth Amendment protection -- the requirement of prior notice. But the issue of delayed or non-existent notice is not only present with remote access searches; it is an issue with all electronic search authorities and especially with searches conducted under the Stored Communications Act, 18 U.S.C. § 2703.

The U.S. Government issues tens of thousands of e-mail search warrants each year, and yet users are rarely given notice when their accounts have been searched. Some providers have been ordered not to notify their subscribers, but the Electronic Communications Privacy Act gag order provisions are quite narrow. The recent release of warrants issued to Google for e-mails of Wikileaks staff members and the battle over the Lavabit warrant raise significant questions about the legality of the Government's gag order process. Under ECPA, users should be notified when a search warrant is issued to obtain the contents of their e-mail accounts and in many cases the government should not be able to prohibit a service provider from notifying their customers.

More recently, Google sent a letter to several Wikileaks staffers, notifying them that their accounts were subject to search warrants and related surveillance orders in the U.S. District Court for the Eastern District of Virginia. According to reports, Google fought the gag orders in these investigations for several years until the warrants were successfully unsealed in May 2014. However, the documents released by Google do not explain the basis for the gag order or the specific authority under which these warrants were granted

In another recent case in the Eastern District of Virginia, the court unsealed warrants and related orders issued to Lavabit after the FBI demanded that the e-mail provider turn over their crypto keys (a Lavabit e-mail account was famously used by Edward Snowden to contact members of the media). The search warrant in that case was issued along with an order under 18 U.S.C. § 2705(b) not to notify any person "of the existence of the attached search warrant." But the Electronic Communications Privacy Act does not clearly authorize gag orders (or even require notice) for e-mail search warrants.

Background -- Notice of Searches Under the Stored Communications Act

The Stored Communications Act (SCA), part of the Electronic Communications Privacy Act of 1986, prohibits access to stored electronic communications and provides law enforcement agents with the authority to compel disclosure of stored communications in certain limited circumstances. Specifically, under 18 U.S.C. § 2703 a "government entity" may require a provider to disclose the contents of a "wire or electronic communication" that is "in electronic storage" under the following circumstances: (1) for a communication that has been in electronic storage for less than 180 days, pursuant to a warrant issued under the Federal Rules of Criminal Procedure (Rule 41) or similar state rules, or (2) for a communication that has been in electronic storage for more than 180 days either (a) pursuant to a warrant without required notice, or (b) pursuant to an administrative subpoena or court order with prior notice to the subscriber. 18 U.S.C. §§ 2703(a)-(b).

The SCA also specifies that a government entity "acting under section 2703(b)" may request an order delaying the notification required under 2703(b) "for a period not to exceed ninety days" if there is "reason to believe that notification" would lead to an "adverse result" as defined in 2705(a)(2). Under section 2705(b), the government can enforce these notice limitations by seeking an order "commanding a provider" for "such period as the court deems appropriate, not to notify any other person" of the existence of the warrant. 18 U.S.C. § 2705(b). However, this gag order only applies to disclosures under 2703(b) -- governing warrants, orders, and subpoenas for communications stored for more than 180 days. So what happens when the government obtains a warrant for "fresh" e-mails that have been stored for less than 180 days?

What Notice is Required? -- In re United States

In July of 2008, the United States applied for two search warrants under section 2703(a) for Google subscriber e-mails. See In re U.S., 685 F. Supp. 2d 1210, 1214 (D. Or. 2009). The Government initially requested that notice to the subscribers be delayed under section 2703(b), but later changed its position and argued that no notice was required under 2703(a) and Rule 41 of the Federal Rules of Criminal Procedure. The magistrate judge found that Rule 41 required the government to provide notice to the subscriber upon execution of the warrant (that is the typical rule for search warrants).

But the Government appealed the magistrate judge's decision to the U.S. District Court for the District of Oregon. In a rare published opinion on search warrant procedures, the court found that the plain language of the SCA was ambiguous as to whether Rule 41 "notice" to the subscriber was required under section 2703(a). The court found that both Rule 41 and Fourth Amendment notice requirements would be satisfied by leaving a copy of the warrant with the service provider. But the court failed to consider whether a valid gag order could be issued to prevent the service provider from notifying its subscriber of the warrant.

In many cases where the Government applies for an e-mail search warrant, as it did in the Lavabit and Wikileaks cases, it will also apply for a gag order under 18 U.S.C. § 2705(b). But the statute makes clear that the gag order provision only applies when (1) the government is "not required to notify the subscriber or customer under section 2703(b)(1)" or (2) where "it may delay such notice pursuant to [section 2705(a)]." What happens when the Government obtains a search warrant for more "recent" e-mails under section 2703(a)? According to the statute, the gag order would not apply and the provider would therefore not be prohibited from notifying their subscriber of the warrant. Yet that did not happen in the Wikileaks or Lavabit cases, so what is going on here?

Where Are All the E-mail Search Warrant Notifications?

My theory is that magistrate judges do not adequately differentiate between search warrants issued for "newer" and "older" e-mails as defined in the SCA (the "180-day rule"). I assume that most e-mail warrants, like those issued in the Lavabit and Wikileaks cases, are blanket requests for "all communications" that do not differentiate between messages stored for more than 180 days and those stored for 180 days or less. We can see from the history of In re U.S. that the Government itself is not always respectful of the distinction either. The problem is that the SCA warrant procedures have not been subject to extensive judicial review. There are fewer than 450 decisions in federal and state courts over the last 30 years that cite 18 U.S.C. 2703. And the only way this issue would come up is if a provider either (1) challenges an unlawful gag order, or (2) challenges a contempt order based on the violation of an unlawful gag order.

Another related problem is the growth in the "shadow docket" handled by federal magistrate judges. As Magistrate Judge Stephen Wm. Smith described in his article, Gagged, Sealed & Delivered: Reforming ECPA's Secret Docket, there is an utter lack of transparency in the judicial process surrounding SCA orders. A 2009 Report by the Federal Judicial Center found that an astonishing number of cases are filed under seal and many of them remain hidden indefinitely. The Report revealed that as of 2008 more than 18,000 warrant-type applications filed in 2006 were still under seal. There were only 66,458 criminal cases filed in 2006.

So how many search warrants are being issued for stored e-mail? According to Google's transparency report, there were 3,187 search warrants issued by the U.S. in the first six months of 2014 alone. According to the Yahoo! transparency report, content was disclosed in response to 1,396 U.S. government data requests in the first six months of 2014. Microsoft reports that they disclosed content in response to roughly 690 U.S. requests in the first six months of 2014. So tens of thousands of e-mail accounts are subject to U.S. search warrants each year, yet we rarely hear about users being notified. The question is, are courts issuing unlawful gag orders or are providers failing to notify their customers after these warrants are served?

May 14, 2014

We have focused a lot on NSA reform since the disclosure of sweeping surveillance last summer, and now Congress is finally taking steps to move the reform process forward. The House Judiciary Committee voted unanimously to pass the USA Freedom Act last week and the House Intelligence Committee followed suit shortly after, paving the way for the bill's consideration by all members of the House with strong bipartisan support. The surveillance reform bill was first introduced back in October following the disclosures of bulk surveillance on Americans.

So far civil liberties advocates have provided mixed reviews of the bill (see examples here, here, here, here, here, and here). Any progress is good, but the newly amended version of the Freedom Act is weaker in terms of its reform of National Security Letter authorities, its protection against back-door searches of Americans' communications collected under Section 702, its creation of a public interest advocate at the FISA Court, and its mandate of greater transparency. Still I think that the amended bill would provide significant protections that do not currently exist in FISA, and would be a step forward for privacy and transparency.

What follows is an in-depth analysis of the major differences between the original USA FREEDOM Act and the current amended bill that will be considered by the U.S. House of Representatives.

House Committee Markups and Amendments

During last week's markup of the USA FREEDOM Act, H.R. 3361, the House Judiciary and Intelligence Committees adopted amendments that made some significant changes, both substantive and structural, to the Freedom Act. Following the amendments, Senator Patrick Leahy (D-Vt), Chairman of the Senate Judiciary Committee and the original co-sponsor of the bill, issued a statement supporting the vote but voicing his concerns that the newly amended bill does not include adequate National Security Letter protections, transparency reforms, or a strong special advocate at the FISA Court. Others have criticized the amended bill for weakening the "bulk collection" restriction and removing an explicit prohibition on "back door searches" for U.S. person communications

But the current version of the bill would still provide an explicit prohibition of bulk collection and improve transparency and oversight of the FISA process, and it is certainly preferable to the intelligence committee proposal that would expand, rather than contract, NSA's spying powers.

The most significant differences between the original Freedom Act and the amended bill are (1) modifications in the National Security Letter reforms, (2) changes to the Special Advocate to an "amicus" position appointed by the FISC, (3) the addition of "two hops" call detail record authority to Section 215, and (4) elimination of some of the transparency reports and addition of "immunity" for certain telecommunications providers. Senator Leahy flagged the first two changes as significant and troubling, so I will focus on those before describing the two different versions of the bill.

National Security Letter Reforms

Title V of the original Freedom Act included four separate categories of reforms: (1) limitations on the collection of telephone toll records and financial records, (2) modification of non-disclosure rules for NSLs, (3) new judicial review procedures, and (4) mandated Inspector General reports. The purpose of these reforms was to elevate the standard for NSLs, to ensure that the government does not use them for bulk collection, and to improve judicial review and set standards for non-disclosure orders in light of the Second Circuit's decision in Doe v. Mukasey, 549 F.3d 861 (2nd Cir. 2008).

The Amended Freedom Act eliminates all but one section of the proposed National Security Letter reforms in the original bill. The remaining section prohibits bulk collection, setting the same "specific selection term" standard used in the Section 215 and FISA Pen Register reforms (see below). The section does not define or specify the types of financial and consumer records that can be obtained using NSLs, nor does it fix the non-disclosure rules or judicial review provisions that the Second Circuit held were unconstitutional in Doe v. Mukasey. As Senator Leahy noted, these amendments eliminated significant and important National Security Letter reforms that should be reintroduced when the Senate considers the bill this summer.

Special Advocate vs. FISC Amicus Curiae

Another major change in the Amended Freedom Act is the loss of the "Special Advocate" proposal that has been championed by Senator Blumenthal, Senator Leahy, and others. The original bill provided for a permanent, independent Special Advocate position, housed within the judiciary, that would wield a great deal of power in the FISA process. The Special Advocate could review all FISA opinions and applications, petition for review or appeal FISC orders, and seek additional disclosure to the public.

But the Special Advocate proposal, as described in the original Freedom Act, has been subject to criticism by Judge Bates of the FISC, and the Congressional Research Service has outlined potential constitutional issues with the position. Professors Steve Vladeck and Marty Lederman have responded to many of those concerns in posts on Just Security and Lawfare, but I think it is important to note that the amended "amicus" provision might be more in line with their defense than was the original Special Advocate proposal.

Rather than establishing a new federal officer with independent power, the amended bill would require the FISC to appoint an amicus from a pre-selected panel of attorneys in any case involving a "significant interpretation of law." This proposal is stronger than the status quo (FISC is permitted to accept amici briefs, but not required to order them), but clearly weaker than the original Special Advocate provision. Hopefully Senator Leahy will re-introduce some of the Special Advocate provisions when the Senate considers the amended bill this summer.

Transparency, Immunity, Two Hops, and Other Significant Changes

Other troubling changes in the amended bill are: the loss of mandatory Inspector General reports regarding the use of both FISA Pen Register and National Security Letter authorities during the period of 2010-2014; and the addition of immunity for compliance with Section 215 orders.

The substitution of the original bill's limitation on 215, Pen Register, and NSL collection with a new "specific selector" standard has been the subject of criticism as well, and Julian Sanchez has questioned whether it might be construed to allow as many as "four hops" (rather than two). But I think this revised language provides a much clearer prohibition on bulk collection than the original, and allowing for "two hops" of call detail records will make it more likely to gain support from both the judiciary and intelligence committees. The FISC would be hard pressed to interpret a provision titled "Prohibition on Bulk Collection" as anything but that, even with aggressive advocacy from DOJ. And the addition of a public interest advocate on this "significant interpretation" would make it even less likely that a "secret" interpretation would undercut the purpose of the amendments.

---

Below I will provide a quick overview of the original version of the USA FREEDOM Act, and compare it with the current amended bill.

---

USA FREEDOM Act 1.0

The version of the Freedom act introduced back in October had five main components: (1) limitation on the use of Section 215 business record orders, FISA Pen Register / Trap and Trace orders, and National Security Letters, (2) prohibition on searching Section 702 "PRISM" data for U.S. Person communications, (3) creation of an Office of the Special Advocate, and (4) new transparency report requirements and oversight powers.

(1) The primary focus of the Freedom Act is to prohibit "bulk collection" of communication records by revising and unifying the standards for Section 215 orders, Pen Register orders, and National Security letters. The original version of the bill did this by requiring that the records sought are both "relevant and material to an authorized investigation into international terrorism or clandestine intelligence," and pertain to "(1) a foreign power or agent of a foreign power; (2) the activities of a suspected agent of a foreign power who is the subject of an investigation; or (3) an individual in contact with, or known to, a suspected agent of a foreign power."

(2) The original version of the Freedom Act explicitly prohibited searches of Section 702-acquired communications "in an effort to find communications of a particular United States person (other than a corporation)," except in emergency circumstances or with the consent of the person whose communications are sought. The bill also amended the Section 702 targeting requirements to make clear that the communications acquired should be limited to those where (1) "any party is a target of the acquisition," or (2) "that contain the account identifier of a target of an acquisition." But the second category of "about" communications can only be acquired "to protect against international terrorism or the international proliferation of weapons of mass destruction."

(3) A large chunk of the original Freedom Act described the role and authority of a new "Office of the Special Advocate." The Special Advocate would have access to all FISA applications and decisions of the FISC, and could seek to participate in FISC proceedings or appeal decisions. The Special Advocate could also request outside amicus participation or petition for public disclosure of FISC decisions, applications, or documents. The Special Advocate would be established within the judicial branch and confirmed by the Chief Justice of the Supreme Court.

(4) The Freedom Act also establishes new reporting and disclosure requirements to improve transparency and oversight of the FISA process. The bill would require new audits by the DOJ and IC Inspectors General for Section 215 Orders issued between 2010-2013, focusing in particular on whether the minimization procedures "adequately protect the constitutional rights of United States persons." The bill would require similar (unclassified) audits by the IGs of the use of FISA Pen Register orders, National Security Letters, and Section 702 orders.

Additional transparency and oversight reforms in the original version of the Freedom Act include rules permitting the aggregate reporting of surveillance orders by third-party recipients like Internet Service Providers and telecommunications companies. The bill would also require that the annual Attorney General FISA reports on the use of electronic surveillance, physical searches, 215 orders, Pen Register orders, and Section 702 orders be made public and include an estimate of the number of United States persons targeted by such surveillance orders. The bill would create a special Attorney General report on the use of National Security Letters.

---

The Amended Freedom Act

When the House Judiciary Committee held its markup of the Freedom Act on May 7, 2014, Representative Jim Sensenbrenner, the primary sponsor of the bill, introduced an amended version of the bill as a substitute. The Amended Freedom Act also has four main components (similar to the original bill): (1) a prohibition on bulk collection under the Section 215, FISA Pen Register, and NSL authorities, (2) amended minimization rules and "reverse targeting" prohibition for Section 702, (3) FISC amicus authority and declassification of significant FISC opinions, and (4) new FISA transparency and reporting requirements. One of the main differences between the two bills is the addition of Section 215 authority for the querying of Call Detail Records, similar to what the President recently proposed.

(1) The first title in the Amended Freedom Act adds new provisions to Section 215 governing applications to obtain "call detail records." Under the new provision, the Government can apply for a 180-day prospective order requiring the production of call detail records "based on a specific selection term" when there is a "reasonable, articulable suspicion" that the term is "associated with a foreign power or an agent of a foreign power." The Government may also require production "using the results of [the first production] as the basis for production." This allows the Government to get call detail records within "two hops" of a target.

The Amended Freedom Act also adds a new provision to Section 215, requiring that each application and order include "a specific selection term to be used as the basis for the production." The amendment makes clear that "No order issued under this subsection may authorize the collection of tangible things without the use of a specific selection term," which is defined as "a term used to uniquely describe a person, entity, or account." The bill also includes a similar "prohibition on bulk collection" for FISA Pen Register orders and National Security Letters, requiring "a specific selection term as the basis for" each request.

(2) The amended bill alters somewhat the rules governing collection under Section 702 ("PRISM"), first by making clearer the prohibition on "reverse targeting" of Americans. Section 702 currently prohibits targeting "a person believed to be located outside the United States if the purpose of such acquisition is to target a particular, known person reasonably believed to be in the United States." The amended language makes clear that reverse targeting is prohibited when it is "a purpose" not just when it is the sole purpose of such acquisition.

The amended bill also requires that the government "minimize the acquisition, and prohibit the retention and dissemination, of any communication" between two U.S. persons and "prohibit the use of any discrete, non-target communication" from a U.S. person or a person "who appears to be located in the United States" except in life threatening circumstances. The amendments also provide a bright line exclusionary rule, providing that "no information obtained or evidence derived from an acquisition" concerning a U.S. person "shall be received in evidence or otherwise disclosed" or used in a proceeding or "in any other manner by Federal officers or employees" without consent.

(3) In place of the original Special Advocate provisions, the amended bill requires that the FISA Court "appoint an individual to serve as amicus curiae to assist" in the consideration of "any application for an order or review that, in the opinion of the court, presents a novel or significant interpretation of the law, unless the court issues a written finding that such appointment is not appropriate." The amended bill also enables the FISC to provide support and assistance for the designated amicus, including training and other executive branch support.

The amended bill also requires that the Attorney General conduct a declassification review of all significant FISA Court opinions and either release them in redacted form, or "make publicly available an unclassified summary" if withholding the full opinion "is necessary to protect the national security of the United States or properly classified intelligence sources or methods."

(4) Finally, the Amended Freedom Act provides for reports by the DOJ and IC Inspectors General, similar to the original bill, but for "calendar years 2012 through 2014" instead of 2010-2013. The amended bill does not require IG reports regarding FISA Pen Register orders or National Security Letters. The amended bill would create new reporting requirements for Section 215 call detail record orders and government compliance reviews under Section 215. The amended bill would also require the Director of the Administrative Office of the United States Courts to submit an annual public report on the number of FISA orders issued, modified, or denied and on the appointment of FISC amicus curiae.

The Amended Freedom Act submitted by Representative Sensenbrenner did not include the third-party transparency provisions that were in the original bill, but during the House Judiciary Committee markup those provisions were approved as an amendment. Representative Rogers introduced that amendment in the House Intelligence Committee Markup.

April 29, 2014

Today the U.S. Supreme Court heard oral argument in Riley v. California and United States v. Wurie, two cases involving the warrantless search of an individual's cell phone incident to arrest. These cases present an important and fundamental Fourth Amendment question: whether the police can search the entire contents of an individual's cell phone incident to any lawful arrest. As others have noted today, the Justices seemed to recognize that cell phones and other digital devices create a "new world" that justifies a modified search incident to arrest rule. But the Justices struggled throughout the arguments in both cases to identify a workable rule.

One important practical insight from Orin Kerr is that, given the short time frame for a decision (the case will be decided by mid-June), it is possible the Justices will seek a unified majority author for both the Riley and Wurie opinions. Given that consideration, and the facts and arguments in Wurie, it is possible that an unexpected "middle ground" compromise will emerge focused on the plain view doctrine. But regardless of the particular majority approach, it seems very unlikely that the Justices will endorse the broad categorical rule that all individuals' cell phones are subject to limitless search incident to arrest. And if the Court can't agree on a compromise solution, Justice Kagan might have enough votes for a categorical ban on warrantless cell phone searches.

It was during the second half of arguments in Riley, while questioning Edward Dumont (Attorney for California), that Justice Breyer first laid out the potential outcomes for both cases:

JUSTICE BREYER: So there are three possibilities: Possibility one, smartphone, no, get a warrant, unless exigent circumstances. Possibility two, yes, it's just like a piece of paper that you find in his pocket. Or possibility three, sometimes yes, sometimes no. All right, which of those three is yours?

And of these three options, the third "middle ground" was the focus of most of the Justices' questions. Over the course of argument in both cases, three distinct "middle ground" proposals emerged: (1) search only "pre-digital" types of information, (2) search only for evidence of the crime of arrest, and (3) conduct a manual search under immediate exigency or plain view. Of those three options, the "plain view" proposal seems more likely to unite a coalition of the Justices in both Riley and Wurie.

The First proposal, described by Mr. Dumont in response to Justice Breyer's question above, would allow officers to search for certain types of information that were traditionally available to police officers during arrest, as compared to some as-yet-undefined "special" digital data that could be subject to greater protection.

MR. DUMONT: Right. And my in­between rule with the explanation is that for information that is of the same sort that police have always been able to seize from the person, that includes diaries, letters, all other kinds of evidence, purely evidentiary, photographs, address books, for evidence of that same sort, the same rule should apply.

But, as Justices Kagan and Breyer quickly pointed out, that exception would swallow the rule. There are "very, very few things that you cannot find an analog to in pre-digital age searches."

The Second proposal, discussed by Justice Scalia and Deputy Solicitor General Michael Dreeben, was that officers could search the cell phone "in order to find evidence of the crime of arrest." This rule, adopted by the Court in the context of automobile searches incident to arrest in Arizona v. Gant, 556 U.S. 332 (2009), would limit the scope of the evidence obtained by law enforcement during the search of an arrestee's cell phone. But Justice Kagan pushed back that this would hardly be a "limiting" principle because cell phones contain such a wealth of private data.

JUSTICE KAGAN: Can I ask you a question about that, Mr. Dreeben, because given the variety of things that these cell phones have in them, it seems as though that's ­­ you know, it sounds good as a limiting principle, but it ends up you can imagine in every case that the police could really look at everything.

The Third proposal, presented by Mr. Dreeben during the Wurie argument would limit officers to "manual searches of the information that's available to the user of the phone." And this proposal is also directly related to a "plain view" rule described by Justice Sotomayor at the end of Mr. Dreeben's time:

JUSTICE SOTOMAYOR: How about a plain view analysis? Turn on the phone, see if there's been a telephone call within a reasonable amount of time of the arrest or ­­ or any message that was sent at the time of arrest. That's sort of a plain view situation. It would take care of your person with the picture of him or herself with guns. It would take care of the call to the confederate. It would take care of the ­­ of the imminent destruction of the phone.

This thread was then picked up by Chief Justice Roberts during his exchange with Judith Minzer (Counsel for Defendant Wurie).

CHIEF JUSTICE ROBERTS: We've ­­ we've kind of gotten far afield, which I'm sure is not ­­ may not be fair to Mr. Fisher or Mr. Dumont, we're talking about their case, but in your case why isn't the information in plain view? It says, "my house, my home." They look at it, that's what they see. They don't have to open anything.

MS. MIZNER: They saw the words "my house." They did have to open the phone and access the log to -

CHIEF JUSTICE ROBERTS: Sure. But I'm saying do you have ­­ you have no objection to the "my house"?

MS. MIZNER: The "my house" words were in plain view. And under this Court's doctrine, that's not --

CHIEF JUSTICE ROBERTS: I assume that that's ­­ it says "my house" because he's done something with the particular number. If he didn't, it would be the number itself that would show up, right?

MS. MIZNER: Yes. And that's part ­­

CHIEF JUSTICE ROBERTS: And so would that also be in plain view?

MS. MIZNER: The number was not in plain view

CHIEF JUSTICE ROBERTS: No, no. But I mean, in a ­­ in a case in which the user had not coded the particular number, the number would show up, I think, right?

MS. MIZNER: Yes. And ­­

CHIEF JUSTICE ROBERTS: And that would be ­­

MS. MIZNER: And the number would be in plain view.

CHIEF JUSTICE ROBERTS: Okay.

Under this plain view and exigency-based rule, officers would be allowed to manually inspect cell phones for recent calls, contacts, or messages, but could not gather evidence generally or download any of the phone data without a warrant. That rule would provide a basis for the Court to distinguish between the facts in Riley and Wurie. The photos, videos, and contact lists at issue in Riley were uncovered after the officers "looked through some stuff" at the station, whereas the phone number in Wurie was revealed by inspecting the contact "my house" that called the phone while it was in the police station.

Interestingly, the Justices did not appear to seriously consider Mr. Dreeben's alternative proposal: that officers could search data stored on the cell phone, but not data stored in the "cloud." EPIC's amicus brief focused on this issue in particular, and argued that it has become increasingly difficult to distinguish between data stored on the phone and data accessed remotely via the cloud. Justice Kagan, in particular, keyed in on the same points in her questioning of Mr. Dreeben during the Wurie argument:

JUSTICE KAGAN: But I thought the whole ideas of smartphones, Mr. Dreeben, and increasingly so, was that even the user doesn't know what what's on the cloud or not.

For those who are unfamiliar with these cases, tou can also find a description of the cases with an index of the briefs and links to relevant news stories on EPIC's webpage here.

April 11, 2014

In light of the President's recent announcement that the NSA's bulk collection of telephone metadata will end, there is a renewed interest in Congress to revise U.S. surveillance laws. At the same time, the Privacy and Civil Liberties Oversight board is conducting its review of the bulk collection of international communications under the Section 702 / PRISM program. While these oversight and reform efforts are underway, it is important to consider the policy-making process that authorized these programs in the first place.

Two Freedom of Information Act cases, one brought by EPIC following the disclosures last summer and another brought by the ACLU several years before, attempt to get to the heart of this question. Both cases lead to the same shocking conclusion - that the Department of Justice Office of Legal Counsel, which played a central role in the initial decision to implement the warrantless wiretapping program, was not involved in the decision to transition those surveillance programs to new FISA authorities.

This revelation that OLC issued no final legal interpretation of either FISA program is surprising because the OLC played a key role in the initial decision by the President to conduct warrantless surveillance in 2001. The Office of Legal Counsel "provides authoritative legal advice to the President and all the Executive Branch agencies" including "offices within the Department." In that capacity, OLC attorneys advised the President and other agencies on legal issues related to the post-2001 surveillance programs. OLC subsequently conducted an in-depth analysis of the constitutional and legal issues raised by the warrantless wiretapping program (the precursor to both PRISM and the Metadata program). But when it came time to transition those programs to a new legal authority, the OLC did not issue any final legal memoranda or opinions regarding the new interpretation of the relevant FISA provisions.

In EPIC v. DOJ, we filed a FOIA suit to obtain from the Office of Legal Counsel:

All final legal analysis, memoranda, and opinions regarding the PRISM program, including, but not limited to, records addressing the Foreign Intelligence Surveillance Act, 50 U.S.C. §§ 1801 et seq., and the Fourth Amendment to the U.S. Constitution

We recently closed that case after the agency provided a letter concluding that there were "no records responsive" to our request, confirming that the OLC never conducted a legal analysis of the PRISM program after it was implemented pursuant to the FISA Amendments Act of 2008.

The ACLU filed a similar, but broader, request for "any and all records concerning the government's interpretation or use of Section 215" to the Department of Justice OLC, NSD, OPA, OIP, and the FBI. In response to ACLU's suit, the OLC identified two responsive documents, but neither of them included a substantive legal analysis of Section 215. The OLC officials had searched specifically for any classified legal opinions about Section 215 and concluded that there were none. This confirms that, like the PRISM program, the legality of the Metadata program was never analyzed by the OLC.

So even though OLC confirmed in EPIC's original warrantless wiretapping FOIA case (at ¶59) that it took part in the "interagency discussions" related to the transition of the warrantless wiretapping program to a series of FISC-authorized programs, it issued no final legal guidance about Section 215. One likely explanation for this lack of final OLC guidance is that the National Security Division attorneys responsible for FISA applications were confident in their interpretation of the statute. But that interpretation (of the 215 Order specifically) has been widely criticized by members of congress (including the original author of the Patriot Act), the PCLOB, and groups like EPIC. The President has decided to end the program and is no longer advocating for that broad interpretation of the law. If the attorneys at NSD felt that their interpretation of 215 authorizing bulk collection was obvious, the recent controversy has proven them wrong.

In regards to the PRISM program, the lack of OLC consultation is understandable but still troubling. The previous OLC memo addressing the warrantless wiretapping program, authored by Jack Goldsmith in May of 2004, provides at least some Fourth Amendment analysis (though it is limited to 6 pages and remains heavily redacted). But this analysis does not address the new issue raised by the FISA Amendments Act itself: what limitations are necessary to ensure that "acquisition" authorized by Section 702 is "conducted in a manner consistent with the Fourth Amendment" (see 50 U.S.C. § 1881a(b)(5)).

This is a significant question of Fourth Amendment law, and one that the Supreme Court recently declined to consider in Clapper v. Amnesty International. The answer hinges on the exact scope of the protections implemented by the NSA in its PRISM systems. But it also depends on the scope of Fourth Amendment protections as applied to international and one-end-domestic communications. Current cases do not provide a clear answer to this question, and that makes it even more important to know who decides what rule will apply. The FISC certainly plays a role, but without adversarial briefing the Government's own internal policy-making process becomes even more significant.

The fact that OLC, the authoritative legal advisor to the President and executive agencies, did not weigh in on this important issue is vexing. And it raises serious questions of institutional legitimacy, including whether Justice Department attorneys properly considered other constitutional issues, including the avoidance doctrine.

February 10, 2014

New reports from the Wall Street Journal and the Washington Post reveal that the NSA's collection of telephone call records under Section 215 of the USA PATRIOT Act is not as "comprehensive" as the Government previously described. Officials now estimate that less than 30% of domestic calls are collected under the 215 program because the collection does not cover records from most cell phone carriers. This severely undercuts the government's two main justifications for the bulk metadata collection program: (1) that it is necessary to have comprehensive call records to conduct link analysis and (2) that querying the database can provide "peace of mind" by indicating that no terrorist links exist. In light of this new revelation, it is now more clear than ever that this program is ineffective and has to end.

But let's look in a bit more detail at how both justifications fall apart because the NSA collects a skewed subset of telephone records.

First, the Government has argued in its bulk collection whitepaper and congressional testimony that the current database provides a "necessary" link analysis capability. And the lower court opinions that have found the program lawful (i.e. Judge Pauley's recent SDNY opinion and Judge Eagan's FISC opinion) both relied on the Government's assertion that "the collection of virtually all telephony metadata is 'necessary' to permit the NSA, not the FBI, to do the algorithmic data analysis that allow the NSA to determine 'connections between known and unknown international terrorist operatives.''"

Judge Eagan's opinion, which the Privacy and Civil Liberties Oversight Board report revealed was the first written opinion from the FISC about the telephone metadata program, relied on the reasoning of Judge Kollar-Kotelly's 2004 Internet metadata (pen register) opinion. In that opinion, Judge Kollar-Kotelly found that the Internet metadata program was lawful because it would acquire "large volumes of communications that, in NSA's estimation, represent a relatively rich environment for finding [redacted] communications through later analysis." Thus, the justification for collection of bulk telephone records would only extend if there was a similarly "rich" sample being collected. But we now know that the telephone records collected are not rich with valuable information; they don't even contain records for most cell phone calls, which make up the majority of phone calls in the United States. It is understandable that link analysis from only landline phone records has not meaningfully contributed to any national security investigations, as the President's Review Group on Intelligence and Communications Technologies found in their report.

Second, Director Clapper and others have argued that the program is also valuable because it provides "peace of mind" to investigators who would like to know whether a particular event is connected with international terrorism. However, this justification fails because the database contains less than 30% of phone calls. There is little "peace of mind" from querying a database that does not include the vast majority of call records.

EPIC has already argued extensively that the program in its current form is unlawful, and the Privacy and Civil Liberties Oversight Board agrees. Even the President has acknowledged that the program should not continue. Given what we know about the ineffectiveness of the NSA's bulk metadata program and the new report that it is not remotely comprehensive, it is clear that neither of the Government's justifications stand up to scrutiny. The facts don't support the Government's own theories or the requirements outlined by the judges who previously authorized the program. The program has to end.

January 28, 2014

Today EPIC is launching our Privacy Rights Blog. The goal of the blog is to expand on our coverage of emerging privacy and open government issues by publishing extended posts written by EPIC staff and special guests. We will post our thoughts on recent news items, legal developments, and policy issues. If you have comments, questions, or suggestions for future blog topics, please contact us at blog [at] epic [dot] org. Thanks for reading!

According to a recent report by the German news site Der Speigel, the NSA's elite hacking division, known as Tailored Access Operations or TAO, has worked with the CIA and FBI to intercept and install surveillance software on laptops ordered by certain targets. This process, called "interdiction," involves diverting the shipments to a secure facility, installing special software, then repackaging and sending the devices to their final destination. While Fourth Amendment protections might not apply to these packages once they leave the country, the seizure and reconfiguration of consumer products by the NSA is a significant privacy intrusion. These operations, if they were to take place within the United States, present two interesting Fourth Amendment issues that are not commonly discussed: the protection afforded to commercial packages in general, and international packages specifically.

Presumably these operations would take place within the United States prior to international departure. (If the NSA is using interdiction to infect laptops bound for domestic destinations, that would pose other significant Constitutional problems.) This raises the question: can NSA (or FBI) intercept and infiltrate these packages without a warrant? The answer depends, in part, on where and how the packages were searched and infiltrated.

Border searches can in many instances be conducted without a warrant, probable cause, or even reasonable suspicion. In United States v. Flores-Montano, 541 U.S. 149 (2004), the Supreme Court affirmed a "narrow" border search exception to the warrant requirement of the Fourth Amendment, grounded in the government's right to protect the nation's "territorial integrity." And the Ninth Circuit recently held that commercial sorting facilities, like those used by FedEx to route international packages, are the "functional equivalent" of the border for purposes of this exception. United States v. Seljan, 547 F.3d 993 (9th Cir. 2008).

But the border search exception is not unequivocal, as the Ninth Circuit recently made clear in United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013). In Cotterman, the court held that a comprehensive and intrusive "forensic examination" of laptops and other digital devices at the border requires reasonable suspicion. This is in line with the Supreme Court's recognition in Flores-Montano that certain "searches of property are so destructive," "particularly offensive," or overtly intrusive that they require particularized suspicion. The Supreme Court just dismissed the petition to review Cotterman, so the forensic examination test is now the law of the Ninth Circuit.

A seizure and subsequent infection of a laptop with sophisticated surveillance software is clearly the type of destructive and overtly intrusive action that should require particularized suspicion under this analysis. But this presents another wrinkle: the role of the commercial carrier (FedEx, UPS, etc) in the interdiction process. At least one federal appellate court has held that the "right to inspect" outlined in FedEx's terms of service agreement eliminated a sender's reasonable expectation of privacy in the contents of their package. United States v. Young, 350 F.3d 1302, 1307 (11th Cir. 2003). Alternatively, the court held that the "bailment" relationship created by the shipment authorized FedEx to consent to a search of the package. Id. at 1308. But this logic has not been broadly applied in other circuits, and there would be significant implications for everyday FedEx and UPS users if it were broadly accepted.

But even under the Eleventh Circuit standard, I think the TAO interdictions described by Der Speigel would still be considered Fourth Amendment searches. First, because even though FedEx may reserve certain rights to inspect the packages it carries, that would not extend to the type of intrusive software infiltration involved in the TAO operations. And second, because the operations are initiated by NSA, rather than the commercial carrier. In United States v. Jacobsen, 466 U.S. 109 (1984), the Supreme Court affirmed that "letters and other sealed packages are in the general class of effects in which the public at large has a legitimate expectation of privacy; warrantless searches of such effects are presumptively unreasonable." Id. at 114. The Court held that the search in Jacobsen was reasonable because the private carrier initially searched the package on their own, without the government's involvement.

Interdictions have significant Fourth Amendment implications, even if they are limited to targeted international shipments, because they go far beyond what has traditionally been allowed under the border search exception. Furthermore, they implicate the rights of not only the customers, but also the vendors of these devices.